Bank Secrecy Act

The Bank Secrecy Act of 1970, or BSA, is the foundation of US anti-money laundering, or AML, law. Enacted on October 26, 1970, it is administered by the Financial Crimes Enforcement Network, known as FinCEN, a bureau of the US Treasury Department.

The BSA is designed to help law enforcement detect and investigate money laundering, terrorist financing, tax crimes and other financial crime. Rather than prohibit all potentially illicit transactions, it requires covered institutions to identify, document and report defined activity, creating records that can be used by FinCEN and authorized government agencies.

What the BSA requires

BSA obligations vary by institution type and activity, but four requirements are central: record keeping, reporting of significant cash transactions, reporting of suspicious activity, and a written AML compliance programme. FinCEN’s implementing rules are primarily found in Title 31 of the Code of Federal Regulations, Chapter X.

• Record keeping: Institutions must retain specified records, including records that help identify parties to certain transfers and other transactions. These requirements support audit trails and regulatory examinations.
• Currency Transaction Reports, or CTRs: A financial institution generally must file a CTR for cash transactions exceeding $10,000 in a single business day. Multiple related cash transactions may need to be aggregated. “Cash” has a specific regulatory meaning and does not simply mean every electronic payment.
• Suspicious Activity Reports, or SARs: Institutions must report transactions that meet applicable thresholds and that they know, suspect, or have reason to suspect involve illegal funds, are intended to evade BSA requirements, lack an apparent lawful purpose, or use the institution to facilitate crime. Thresholds and timing differ by sector.
• AML programme: Covered institutions must adopt and operate a risk-based programme reasonably designed to meet their BSA obligations.

AML programme and customer due diligence

An effective BSA/AML programme is not limited to filing reports. It is an ongoing control framework tailored to an institution’s products, customers, delivery channels, geographic exposure and transaction risks. Regulators generally expect programmes to include the following core elements:

• Internal controls, including policies, procedures, monitoring and escalation processes designed to manage identified risks.
• Independent testing, often conducted by qualified internal audit personnel or an external reviewer, to assess whether the programme is working.
• A designated BSA officer with sufficient authority, resources and access to information to oversee compliance.
• Training for relevant employees, tailored to their roles and the institution’s risk profile.
• Customer due diligence, or CDD, including risk-based customer identification and verification, understanding the nature and purpose of customer relationships, ongoing monitoring, and identification and verification of beneficial owners where required. A beneficial owner is a natural person who ultimately owns or controls a legal-entity customer.

Who must comply

The BSA applies broadly to “financial institutions,” a term defined by statute and regulation. Covered entities include banks and credit unions, money services businesses such as money transmitters and currency exchanges, casinos, broker-dealers, mutual funds, futures commission merchants, and certain other regulated financial businesses. Specific programme, reporting and recordkeeping rules differ across these sectors.

Later changes to the framework

Congress has expanded the BSA framework several times. The USA PATRIOT Act of 2001 added significant AML requirements following the September 11 attacks, including customer identification programme requirements for many financial institutions and enhanced due diligence in specified higher-risk relationships.

The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act, directed wide-ranging modernization of the US AML regime. Its provisions included reforms relating to beneficial ownership information, whistleblower incentives, penalties, information sharing and the risk-based application of AML rules. Implementation has occurred through subsequent rulemakings and agency actions.

Compliance context

BSA compliance is supervised by FinCEN and, depending on the institution, federal banking agencies, the Securities and Exchange Commission, the Commodity Futures Trading Commission, the Internal Revenue Service and state regulators. Failures can lead to civil penalties, enforcement actions and, in serious cases, criminal exposure. This explainer is general information, not legal advice; organizations should seek qualified legal and compliance advice for their specific activities.